Files containing personal information on 287 employees, patients and former patients at a state mental hospital have been stolen - creating the risk of identity theft.
The paper files were in a briefcase taken April 21 from a hospital employee's car while it was parked at Bear Creek Park in southwest Denver.
The employee of the Colorado Mental Health Institute at Fort Logan had taken the files home to work on, said Liz McDonough, spokeswoman for the state human services department.
Taking files home is a violation of department policy, she said.
The 12-year employee has been "retrained," and further disciplinary action is possible, she said.
"This is a very real threat," said Evan Hendricks, publisher of Privacy Times and author of the book "Credit Scores & Credit Reports."
The department sent out letters Tuesday notifying 247 patients whose files were taken, McDonough said. The 40 employees affected were alerted the next business day after the theft.
The patient notification took more than six weeks because of the "painstaking process" of determining exactly what was in the files, McDonough said.
Twenty-nine of the 40 staff files included names, addresses and Social Security numbers. Names, gender, birth dates and Social Security numbers were in 40 of the patient files, she said.
In the rest, the file contained only the patient's name and what hospital staffers call a "day note" - a notation indicating where a patient is housed and their condition.
Nancy Tucker, the mother of a former Fort Logan patient, called the theft "alarming" and said she was concerned because so much time elapsed before patients were notified. "During that time, a lot can happen," she said.
Tucker, a member of Citizens for Fort Logan, which opposed proposed budgets cuts at the hospital, said Fort Logan strives to maintain patient privacy.
There have been rumors the state intends to close the hospital, and many beds there have been eliminated in recent years.
The first step anyone in this situation should take is to put a freeze on a credit report, said Privacy Times' Hendricks.
"By putting a freeze on your credit report, you've stopped the key moment when they can obtain credit in your name," he said. "Given the real threat and that these people might not be up to doing this themselves, they should appoint somebody in charge of doing all these chores."
McDonough said the state has offered services to those whose files were taken, including assistance in putting alerts in their credit files.
She said the theft was reported to police and that officials believe it was random.
Notification of the theft comes just weeks after computer files containing data on more than 26 million veterans were stolen from the home of a Department of Veterans Affairs employee.
In May 2005, medical and special-education records of more than 1,600 Colorado children were stolen along with a car belonging to a state health department employee.